gongzhiyongandClaude Opus 4.8
fb1eeeebfa
#1 稳定性:HEARTBEAT_TIMEOUT 30→120(可配 AGENT_HEARTBEAT_TIMEOUT)——真实仓 clone/长 模型调用不再误杀 agent。 #2 正确性/忠实度: - 透传 GIT_BASE_COMMIT;agent clone 改为浅 fetch+checkout 该 commit(在正确基线上读/改, 且大仓也快);emit_patch 持久化 base_commit + _git_diff 对 SHA 走浅 fetch。 - agent 读文件预算可配并调大(AGENT_CTX_MAX_FILES=40/BYTES=40000),LLM 看到完整文件, 避免全量重写截断 → diff 失真。launcher 透传这些 env 给 agent pod。 import + runtime-contract/result-aggregator/security-boundary 测试全绿。 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
187 lines
8.6 KiB
YAML
187 lines
8.6 KiB
YAML
# heicode-test 云部署清单（SWE-bench 涌现评测 · 生成段）—— 改自 orchestrator-local.yaml。
|
||
# 与本地差异：ACR 镜像（非 local）、Redis 集群（REDIS_URL+REDIS_CLUSTER）、隔离沙箱双门控开、
|
||
# SWARM_EMIT_PATCH 产 diff（不落 main）、Cosmos/Blob 用测试专属 database/container 与生产区分、
|
||
# Service=LoadBalancer 公网裸入（本地测试式，无鉴权）。
|
||
# 所有凭据走 Secret（secretKeyRef），manifest 内零明文。创建 Secret 见文件末尾注释（你自行执行）。
|
||
apiVersion: v1
|
||
kind: Service
|
||
metadata:
|
||
name: orchestrator-public
|
||
namespace: swarm-system
|
||
labels: { app: orchestrator }
|
||
spec:
|
||
type: LoadBalancer # 公网入口（无鉴权，仅限隔离测试集群）；建议加 loadBalancerSourceRanges 限 IP
|
||
ports:
|
||
- port: 80
|
||
targetPort: 8000
|
||
name: http
|
||
selector: { app: orchestrator }
|
||
---
|
||
apiVersion: v1
|
||
kind: Service
|
||
metadata:
|
||
name: orchestrator-service # 集群内 WS 入口（agent pod 连这个），保持与 local 同名
|
||
namespace: swarm-system
|
||
labels: { app: orchestrator }
|
||
spec:
|
||
type: ClusterIP
|
||
ports:
|
||
- port: 8000
|
||
targetPort: 8000
|
||
name: http
|
||
selector: { app: orchestrator }
|
||
---
|
||
apiVersion: apps/v1
|
||
kind: Deployment
|
||
metadata:
|
||
name: orchestrator
|
||
namespace: swarm-system
|
||
labels: { app: orchestrator }
|
||
spec:
|
||
replicas: 1
|
||
selector:
|
||
matchLabels: { app: orchestrator }
|
||
template:
|
||
metadata:
|
||
labels: { app: orchestrator }
|
||
spec:
|
||
serviceAccountName: swarm-orchestrator
|
||
# ACR 拉取：AKS 已 attach ACR 时无需此项；否则用 imagePullSecret。
|
||
# imagePullSecrets: [{ name: acr-pull }]
|
||
containers:
|
||
- name: orchestrator
|
||
image: heicodetest.azurecr.io/swarm-orchestrator:heicode-test # ← 填 ACR
|
||
imagePullPolicy: Always
|
||
ports:
|
||
- containerPort: 8000
|
||
name: http
|
||
env:
|
||
# --- Redis 集群（权威存储，非 FAKE）---
|
||
# REDIS_URL 形如 rediss://:<password>@<host>:<port>/0；含密码 → 走 Secret。
|
||
- name: REDIS_URL
|
||
valueFrom:
|
||
secretKeyRef: { name: swarm-redis, key: REDIS_URL }
|
||
- name: REDIS_CLUSTER
|
||
value: "1" # Azure Redis Enterprise OSSCluster 协议需要
|
||
- name: LOG_LEVEL
|
||
value: "INFO"
|
||
# --- agent pod 启动（ACR 镜像）---
|
||
- name: AGENT_LAUNCH_BACKEND
|
||
value: "kubernetes"
|
||
- name: AGENT_POD_IMAGE
|
||
value: "heicodetest.azurecr.io/swarm-agent:heicode-test" # ← 填 ACR
|
||
- name: AGENT_POD_NAMESPACE
|
||
value: "swarm-system"
|
||
- name: ORCHESTRATOR_PUBLIC_URL
|
||
value: "ws://orchestrator-service.swarm-system.svc.cluster.local:8000"
|
||
# --- 模型网关（OpenAI 兼容）= 你的叮嘱：qwen3.7-max @ api.heicode.cc ---
|
||
- name: AGENT_OPENAI_API_BASE
|
||
value: "https://api.heicode.cc/v1"
|
||
- name: OPENAI_API_BASE
|
||
value: "https://api.heicode.cc/v1"
|
||
- name: OPENAI_MODEL
|
||
value: "qwen3.7-max"
|
||
- name: MASTER_REVIEW_MODEL # 聚合器整合也用同模型（锁模型）
|
||
value: "qwen3.7-max"
|
||
- name: OPENAI_API_KEY
|
||
valueFrom:
|
||
secretKeyRef: { name: swarm-model-key, key: OPENAI_API_KEY }
|
||
# Jina MCP key — launcher 透传给 agent pod(SENSITIVE → per-swarm Secret),
|
||
# agent 用它连 mcp.jina.ai 取 search_web/read_url 工具做 function-calling。
|
||
- name: JINA_API_KEY
|
||
valueFrom:
|
||
secretKeyRef: { name: swarm-jina-key, key: JINA_API_KEY }
|
||
# --- agent 池窗口（弹性）---
|
||
# 初始只起 2 个；autoscale loop 按 PENDING 积压按需扩到 MAX/per-user 上限。
|
||
- name: ENABLE_AGENT_AUTOSCALING
|
||
value: "1"
|
||
- name: AGENT_LAUNCH_MIN_POOL
|
||
value: "2"
|
||
- name: AGENT_LAUNCH_POOL_SIZE
|
||
value: "2"
|
||
- name: AGENT_LAUNCH_MAX_POOL
|
||
value: "64"
|
||
- name: MAX_AGENTS_PER_USER
|
||
value: "64"
|
||
- name: AGENT_PROPOSAL_BUDGET
|
||
value: "12"
|
||
# plan/分解 token 上限：降到 32768 避开模型网关 >32768 → 400(launcher 透传给 agent pod)
|
||
- name: AGENT_PLAN_MAX_TOKENS
|
||
value: "32768"
|
||
# 心跳超时：真实仓 clone/长模型调用会让 agent >30s 不心跳被误杀,放宽到 120s
|
||
- name: AGENT_HEARTBEAT_TIMEOUT
|
||
value: "120"
|
||
# 真实仓上下文预算（launcher 透传给 agent pod）：让 LLM 看到完整文件,避免重写截断
|
||
- name: AGENT_CTX_MAX_FILES
|
||
value: "40"
|
||
- name: AGENT_CTX_MAX_BYTES
|
||
value: "40000"
|
||
# 协作聚合质量门：pass_rate<70 打回迭代（对齐本地已验证收敛行为；未设=门关=不打回）
|
||
- name: AGGREGATE_ACCEPTANCE_THRESHOLD
|
||
value: "70"
|
||
# SWE-bench repo clone 凭据（dev secret 解析：grant.secret_ref 末段 swe_git_1 → 读此 env）
|
||
# JSON {"git_username":...,"git_password":...}，走 Secret，绝不明文。
|
||
- name: HEICODE_SECRET_swe_git_1
|
||
valueFrom:
|
||
secretKeyRef: { name: swarm-git-grant, key: HEICODE_SECRET_swe_git_1 }
|
||
# --- 隔离沙箱双门控（heicode-test 已确认隔离集群）---
|
||
- name: ENABLE_QUALITY_EVAL
|
||
value: "1"
|
||
- name: HEICODE_SANDBOX_ISOLATED
|
||
value: "1"
|
||
# 代码沙箱后端：daytona = 在 Daytona 云沙箱执行模型生成代码(不在本 Pod 跑,隔离更强)；
|
||
# 出错 fail-soft 回退 Pod 内 subprocess。双门控不变。
|
||
- name: SANDBOX_BACKEND
|
||
value: "daytona"
|
||
- name: DAYTONA_API_URL
|
||
value: "https://app.daytona.io/api"
|
||
- name: DAYTONA_API_KEY
|
||
valueFrom:
|
||
secretKeyRef: { name: swarm-daytona-key, key: DAYTONA_API_KEY }
|
||
# --- SWE-bench 评测：产 unified diff，不 push 到 main ---
|
||
- name: SWARM_EMIT_PATCH
|
||
value: "1"
|
||
# --- 采集遥测：与生产 Cosmos/Blob 共用底座，但用测试专属 database/container 区分 ---
|
||
- name: BENCHMARK_COSMOS_DATABASE
|
||
value: "benchmark-heicodetest" # 区分键（生产默认 benchmark）
|
||
- name: BENCHMARK_COSMOS_CONTAINER
|
||
value: "selfcert-heicodetest" # 区分键（生产默认 selfcert）
|
||
- name: BENCHMARK_BLOB_CONTAINER
|
||
value: "selfcert-heicodetest" # 区分键（生产默认 benchmark-selfcert）
|
||
- name: BENCHMARK_COSMOS_CONNECTION_STRING
|
||
valueFrom:
|
||
secretKeyRef: { name: swarm-telemetry, key: COSMOS_CONNECTION_STRING, optional: true }
|
||
- name: AZURE_STORAGE_CONNECTION_STRING
|
||
valueFrom:
|
||
secretKeyRef: { name: swarm-telemetry, key: AZURE_STORAGE_CONNECTION_STRING, optional: true }
|
||
resources:
|
||
requests: { memory: "512Mi", cpu: "300m" }
|
||
limits: { memory: "1Gi", cpu: "1" }
|
||
livenessProbe:
|
||
httpGet: { path: /health, port: 8000 }
|
||
initialDelaySeconds: 20
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 3
|
||
readinessProbe:
|
||
httpGet: { path: /health, port: 8000 }
|
||
initialDelaySeconds: 8
|
||
periodSeconds: 5
|
||
timeoutSeconds: 3
|
||
failureThreshold: 3
|
||
# ---------------------------------------------------------------------------
|
||
# 创建 Secret（你自行执行，凭据不进任何文件/日志；用 ! 前缀在会话里跑）：
|
||
# kubectl -n swarm-system create secret generic swarm-model-key \
|
||
# --from-literal=OPENAI_API_KEY=<模型KEY>
|
||
# kubectl -n swarm-system create secret generic swarm-redis \
|
||
# --from-literal=REDIS_URL='rediss://:<password>@<host>:<port>/0'
|
||
# # 遥测（可选，不重要时可跳过；跳过则 export 自动 no-op）：
|
||
# kubectl -n swarm-system create secret generic swarm-telemetry \
|
||
# --from-literal=COSMOS_CONNECTION_STRING='<...>' \
|
||
# --from-literal=AZURE_STORAGE_CONNECTION_STRING='<...>'
|
||
# 部署：
|
||
# kubectl create -f k8s/rbac/
|
||
# kubectl create -f k8s/orchestrator-heicode-test.yaml
|
||
# kubectl -n swarm-system get svc orchestrator-public -w # 等 EXTERNAL-IP
|
||
# ---------------------------------------------------------------------------
|